CVE-2019-25640
Published: 24 March 2026
Description
Inout Article Base CMS contains SQL injection vulnerabilities that allow unauthenticated attackers to manipulate database queries through the 'p' and 'u' parameters. Attackers can inject SQL code using XOR-based payloads in GET requests to portalLogin.php to extract sensitive database information…
more
or cause denial of service through time-based attacks.
Mitigating Controls (NIST 800-53 r5)AI
Enforces validation and sanitization of untrusted inputs like the 'p' and 'u' GET parameters in portalLogin.php to directly prevent SQL injection exploitation.
Requires timely remediation of identified flaws, such as patching CVE-2019-25640 in Inout Article Base CMS to eliminate the SQL injection vulnerability.
Implements boundary protection mechanisms like web application firewalls to inspect and block malicious SQL injection payloads in network traffic to portalLogin.php.
Security SummaryAI
CVE-2019-25640 is an SQL injection vulnerability (CWE-89) in Inout Article Base CMS, affecting the portalLogin.php component. The flaw arises from insufficient sanitization of the 'p' and 'u' parameters in GET requests, enabling attackers to manipulate database queries with XOR-based payloads. Published on 2026-03-24, it carries a CVSS v3.1 base score of 8.2 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N), indicating high severity due to network accessibility and confidentiality risks.
Unauthenticated remote attackers can exploit this vulnerability by sending crafted GET requests to portalLogin.php. Successful exploitation allows extraction of sensitive database information or denial of service via time-based blind SQL injection techniques, with low attack complexity and no user interaction required.
Advisories and proof-of-concept exploits detail the issue, including an Exploit-DB entry at https://www.exploit-db.com/exploits/46593, the vendor product page at https://www.inoutscripts.com/products/inout-article-base/, and a VulnCheck advisory at https://www.vulncheck.com/advisories/inout-article-base-cms-lastest-sql-injection-via-portallogin-php. Practitioners should consult these for detection signatures, patch availability, or upgrade guidance from the vendor.
Details
- CWE(s)
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SQL injection in public-facing web application (portalLogin.php) directly enables exploitation of public-facing application (T1190) and facilitates data collection from databases via query manipulation (T1213.006).